From 0dde90edcb0aafef5f4b5fc3d30e19f756e27ee4 Mon Sep 17 00:00:00 2001 From: Jonathan Hui Date: Tue, 13 Aug 2019 08:49:51 -0700 Subject: [PATCH] [fuzz] avoid tasklet execution if platform was reset (#4093) --- tests/fuzz/Makefile.am | 35 +++++++++++++++++++----- tests/fuzz/cli_uart_received.cpp | 6 ++--- tests/fuzz/fuzzer_platform.c | 8 ++++++ tests/fuzz/fuzzer_platform.h | 44 +++++++++++++++++++++++++++++++ tests/fuzz/ip6_send.cpp | 6 ++--- tests/fuzz/ncp_uart_received.cpp | 6 ++--- tests/fuzz/radio_receive_done.cpp | 6 ++--- 7 files changed, 93 insertions(+), 18 deletions(-) create mode 100644 tests/fuzz/fuzzer_platform.h diff --git a/tests/fuzz/Makefile.am b/tests/fuzz/Makefile.am index 0ad1697e0..eafd19839 100644 --- a/tests/fuzz/Makefile.am +++ b/tests/fuzz/Makefile.am @@ -46,24 +46,47 @@ COMMON_LDADD = \ $(LIB_FUZZING_ENGINE) \ $(NULL) +COMMON_SOURCES = \ + fuzzer_platform.c \ + fuzzer_platform.h \ + $(NULL) + cli_uart_received_fuzzer_LDADD = \ $(top_builddir)/src/cli/libopenthread-cli-ftd.a \ $(COMMON_LDADD) \ $(NULL) -cli_uart_received_fuzzer_SOURCES = cli_uart_received.cpp fuzzer_platform.c +cli_uart_received_fuzzer_SOURCES = \ + $(COMMON_SOURCES) \ + cli_uart_received.cpp \ + $(NULL) -ip6_send_fuzzer_LDADD = $(COMMON_LDADD) -ip6_send_fuzzer_SOURCES = ip6_send.cpp fuzzer_platform.c +ip6_send_fuzzer_LDADD = \ + $(COMMON_LDADD) \ + $(NULL) -radio_receive_done_fuzzer_LDADD = $(COMMON_LDADD) -radio_receive_done_fuzzer_SOURCES = radio_receive_done.cpp fuzzer_platform.c +ip6_send_fuzzer_SOURCES = \ + $(COMMON_SOURCES) \ + ip6_send.cpp \ + $(NULL) + +radio_receive_done_fuzzer_LDADD = \ + $(COMMON_LDADD) \ + $(NULL) + +radio_receive_done_fuzzer_SOURCES = \ + $(COMMON_SOURCES) \ + radio_receive_done.cpp \ + $(NULL) ncp_uart_received_fuzzer_LDADD = \ $(top_builddir)/src/ncp/libopenthread-ncp-ftd.a \ $(COMMON_LDADD) \ $(NULL) -ncp_uart_received_fuzzer_SOURCES = ncp_uart_received.cpp fuzzer_platform.c +ncp_uart_received_fuzzer_SOURCES = \ + $(COMMON_SOURCES) \ + ncp_uart_received.cpp \ + $(NULL) include $(abs_top_nlbuild_autotools_dir)/automake/post.am diff --git a/tests/fuzz/cli_uart_received.cpp b/tests/fuzz/cli_uart_received.cpp index f2ff22f12..d96e7e975 100644 --- a/tests/fuzz/cli_uart_received.cpp +++ b/tests/fuzz/cli_uart_received.cpp @@ -40,11 +40,9 @@ #include #include +#include "fuzzer_platform.h" #include "common/code_utils.hpp" -extern "C" void FuzzerPlatformInit(void); -extern "C" void FuzzerPlatformProcess(otInstance *aInstance); - extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { const otPanId panId = 0xdead; @@ -69,6 +67,8 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) otPlatUartReceived(buf, (uint16_t)size); + VerifyOrExit(!FuzzerPlatformResetWasRequested()); + for (int i = 0; i < MAX_ITERATIONS; i++) { while (otTaskletsArePending(instance)) diff --git a/tests/fuzz/fuzzer_platform.c b/tests/fuzz/fuzzer_platform.c index e07f224fd..69cfdd900 100644 --- a/tests/fuzz/fuzzer_platform.c +++ b/tests/fuzz/fuzzer_platform.c @@ -49,6 +49,7 @@ static AlarmState sAlarmMicro; static uint32_t sRandomState = 1; static uint8_t sRadioTransmitPsdu[OT_RADIO_FRAME_MAX_SIZE]; static otRadioFrame sRadioTransmitFrame = {.mPsdu = sRadioTransmitPsdu}; +static bool sResetWasRequested = false; void FuzzerPlatformInit(void) { @@ -92,6 +93,11 @@ void FuzzerPlatformProcess(otInstance *aInstance) } } +bool FuzzerPlatformResetWasRequested(void) +{ + return sResetWasRequested; +} + uint32_t otPlatAlarmMilliGetNow(void) { return sAlarmNow / 1000; @@ -159,6 +165,8 @@ void otDiagProcessCmdLine(otInstance *aInstance, const char *aString, char *aOut void otPlatReset(otInstance *aInstance) { OT_UNUSED_VARIABLE(aInstance); + + sResetWasRequested = true; } otPlatResetReason otPlatGetResetReason(otInstance *aInstance) diff --git a/tests/fuzz/fuzzer_platform.h b/tests/fuzz/fuzzer_platform.h new file mode 100644 index 000000000..2a87efdc3 --- /dev/null +++ b/tests/fuzz/fuzzer_platform.h @@ -0,0 +1,44 @@ +/* + * Copyright (c) 2019, The OpenThread Authors. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * 3. Neither the name of the copyright holder nor the + * names of its contributors may be used to endorse or promote products + * derived from this software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE + * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +#ifndef FUZZER_PLATFORM_H_ +#define FUZZER_PLATFORM_H_ + +#ifdef __cplusplus +extern "C" { +#endif + +void FuzzerPlatformInit(void); +void FuzzerPlatformProcess(otInstance *aInstance); +bool FuzzerPlatformResetWasRequested(void); + +#ifdef __cplusplus +} // extern "C" +#endif + +#endif // FUZZER_PLATFORM_H_ diff --git a/tests/fuzz/ip6_send.cpp b/tests/fuzz/ip6_send.cpp index d9f3318a1..a28f8fe0e 100644 --- a/tests/fuzz/ip6_send.cpp +++ b/tests/fuzz/ip6_send.cpp @@ -38,11 +38,9 @@ #include #include +#include "fuzzer_platform.h" #include "common/code_utils.hpp" -extern "C" void FuzzerPlatformInit(void); -extern "C" void FuzzerPlatformProcess(otInstance *aInstance); - extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { const otPanId panId = 0xdead; @@ -75,6 +73,8 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) message = NULL; + VerifyOrExit(!FuzzerPlatformResetWasRequested()); + for (int i = 0; i < MAX_ITERATIONS; i++) { while (otTaskletsArePending(instance)) diff --git a/tests/fuzz/ncp_uart_received.cpp b/tests/fuzz/ncp_uart_received.cpp index 2b634c54b..857dd4e75 100644 --- a/tests/fuzz/ncp_uart_received.cpp +++ b/tests/fuzz/ncp_uart_received.cpp @@ -40,11 +40,9 @@ #include #include +#include "fuzzer_platform.h" #include "common/code_utils.hpp" -extern "C" void FuzzerPlatformInit(void); -extern "C" void FuzzerPlatformProcess(otInstance *aInstance); - extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { const otPanId panId = 0xdead; @@ -69,6 +67,8 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) otPlatUartReceived(buf, (uint16_t)size); + VerifyOrExit(!FuzzerPlatformResetWasRequested()); + for (int i = 0; i < MAX_ITERATIONS; i++) { while (otTaskletsArePending(instance)) diff --git a/tests/fuzz/radio_receive_done.cpp b/tests/fuzz/radio_receive_done.cpp index cacbaae5c..cafcf8b61 100644 --- a/tests/fuzz/radio_receive_done.cpp +++ b/tests/fuzz/radio_receive_done.cpp @@ -39,11 +39,9 @@ #include #include +#include "fuzzer_platform.h" #include "common/code_utils.hpp" -extern "C" void FuzzerPlatformInit(void); -extern "C" void FuzzerPlatformProcess(otInstance *aInstance); - extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) { const otPanId panId = 0xdead; @@ -73,6 +71,8 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) otPlatRadioReceiveDone(instance, &frame, OT_ERROR_NONE); + VerifyOrExit(!FuzzerPlatformResetWasRequested()); + for (int i = 0; i < MAX_ITERATIONS; i++) { while (otTaskletsArePending(instance))